Closed Bug 1684864 Opened 5 years ago Closed 5 years ago

TLS should be required for Onion domains.

Categories

(Core :: Security, enhancement)

Product:
Core
Component:
Security
Type:
enhancement

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: u677327, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Onion domains are just another network layer and are vulnerable to misconfigurations, software bugs, vulnerabilities that any other network layer has, and their encryption release cycle is much slower than browsers.

  1. TLS certificates on Onion domains provide a trust-on-first-use certificate pinning functionality that is equivalent to HPKP.

  2. A web service isn't truly secure unless it uses an HSM and there is limited support for HSM storage of Onion keys but widespread support for TLS keys.

  3. Requiring TLS on Onions will force more support for it's use like the related bug.

  4. Onion was recently designated as a special TLD and CAs are allowed to issue non-EV basic certificates.

TLS should be required for Onion domains.

Related: https://bugzilla.mozilla.org/show_bug.cgi?id=1618382

Adding .onion to the HSTS preload list may be the best solution.

Disregard my last comment related to the HSTS preload since that would block self-signed certificates.

This is too early.

Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.